fix(solana): check unique stake withdraw recipient
What the developer wrote
Authored by Jakub Janků
fix(solana): check unique stake withdraw recipient
Prior to this commit, trezor used special UI flow for solana
transactions that contained only stake withdraw instructions. The
problem was that only the total withdrawn amount was shown without the
per-recipient breakdown of the amount.
This change restricts the use of the special flow only to cases where
the recipient is the same across all withdraw instructions. This unifies
the behavior of the `try_confirm_token_transfer_transaction` and
`try_confirm_staking_transaction` functions. If the recipient differs
from the signer, a warning is shown.
NOTE: This change also fixes the issue that the special flow could be
aborted without user interaction --- this could happen when the
transaction contained one supported instruction (by the special flow)
with a recipient other than the wallet and one unsupported instruction.
First, the user would see the recipient warning (part of the special
flow), but then this flow would be aborted and the default per-
instruction confirmation flow would start.
(cherry picked from commit 6b84dcdd241410c90fce8dbd4d8f8a2454aceeaf)
What changed, and why it matters
This update fixes a display issue in Trezor's Solana staking withdrawal flow. Previously, when withdrawing staked SOL, the device could show only the total amount being withdrawn even if multiple different recipients were involved, and in some mixed transactions it could silently drop back to a normal flow after showing a warning. Now the device requires all withdrawals in a simplified transaction to go to the same recipient, and it explicitly asks the user to confirm that recipient if it is not their own wallet.
Treat this as a security-hardening fix and include it in the next firmware release. Users should update firmware when available. Wallet software integrating Trezor's Solana signing should review whether it previously relied on the simplified staking-withdraw flow for multi-recipient transactions.
Security signals we found
UI flow could hide per-recipient amounts in multi-recipient stake withdrawals
Mixed transactions could abort special flow after showing a warning, potentially without full user confirmation
Changelog filed under .security category
Patch unifies behavior with existing token-transfer confirmation logic
Evidence from the diff
The patch modifies try_confirm_staking_transaction in core/src/apps/solana/predefined_transaction.py. Before, the function looped over stake-withdraw instructions and showed a recipient warning (confirm_claim_recipient) for each instruction whose recipient differed from the signer, then summed amounts. This allowed a special simplified flow for transactions with multiple different recipients (only total shown) and could abort to the default per-instruction flow mid-way if an unsupported instruction appeared. The new code records the recipient from the first instruction, rejects the special flow if any subsequent withdraw instruction has a different recipient, and shows a single recipient confirmation only when the common recipient is not the signer. A changelog entry classifies this as a security fix for previously hidden Solana instruction parameters.
Changed components
Trezor firmware Solana appcore/src/apps/solana/predefined_transaction.pystake withdraw transaction confirmation UI flowInspect captured patch +7 / −2
diff --git a/core/.changelog.d/281.security b/core/.changelog.d/281.security
new file mode 100644
index 00000000..5eb1da68
--- /dev/null
+++ b/core/.changelog.d/281.security
@@ -0,0 +1 @@
+Ask user for confirmation of some previously hidden Solana instruction parameters.
diff --git a/core/src/apps/solana/predefined_transaction.py b/core/src/apps/solana/predefined_transaction.py
index 617b85a0..a5c210ab 100644
--- a/core/src/apps/solana/predefined_transaction.py
+++ b/core/src/apps/solana/predefined_transaction.py
@@ -349,15 +349,19 @@ async def try_confirm_staking_transaction(
from .layout import confirm_claim_recipient, confirm_claim_transaction
total_amount = 0
+ recipient = instructions[0].recipient_account[0]
for withdraw in instructions:
if signer_public_key != withdraw.withdrawal_authority[0]:
return False
if is_address_reference(withdraw.recipient_account):
return False
- if signer_public_key != withdraw.recipient_account[0]:
- await confirm_claim_recipient(withdraw.recipient_account[0], chunkify)
+ if recipient != withdraw.recipient_account[0]:
+ return False
total_amount += withdraw.lamports
+ if recipient != signer_public_key:
+ await confirm_claim_recipient(recipient)
+
await confirm_claim_transaction(
fee=fee,
signer_path=signer_path,
Why this scored 62/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.